fix: prevent platformClientId spoofing in booking metadata

devin-ai-integration[bot] · devin-ai-integration[bot] · commit 4c47361bcdff · 2026-02-04T13:08:41.000Z
Co-Authored-By: unknown &lt;&gt;
diff --git a/apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts b/apps/api/v2/src/ee/bookings/2024-08-13/services/input.service.ts
@@ -191,7 +191,7 @@ export class InputBookingsService_2024_08_13 {
       timeZone: inputBooking.attendee.timeZone,
       language: inputBooking.attendee.language || "en",
       metadata: {
-        ...(inputBooking.metadata || {}),
+        ...(({ platformClientId: _, ...rest }) => rest)(inputBooking.metadata || {}),
         ...(platformClientId && { platformClientId }),
       },
       hasHashedBookingLink: false,
@@ -531,7 +531,7 @@ export class InputBookingsService_2024_08_13 {
         timeZone: inputBooking.attendee.timeZone,
         language: inputBooking.attendee.language || "en",
         metadata: {
-          ...(inputBooking.metadata || {}),
+          ...(({ platformClientId: _, ...rest }) => rest)(inputBooking.metadata || {}),
           ...(platformClientId && { platformClientId }),
         },
         hasHashedBookingLink: false,
